Google Pauses Open‑Source Bug Bounty Amid Flood of AI‑Generated Reports

Google said it is pausing its open‑source bug bounty program for the time being after detecting a rapid rise in AI‑generated submissions, calling the influx overwhelming to its processes.

It noted that in recent weeks the amount of AI‑crafted reports has surged, putting pressure on its internal triage workflow and complicating analysts’ ability to separate real flaws from low‑quality or duplicate entries.

Bug bounty programs, which pay outside researchers for identifying security issues, now form a key pillar of contemporary software protection. Google’s open‑source effort, created to safeguard its numerous libraries and frameworks, has traditionally drawn a varied community of independent security hunters.

The statement said that the flood of AI‑generated submissions has both swollen the total count and diminished overall reliability. “We are seeing a significant rise in AI‑derived reports that lack the depth and reproducibility needed for effective remediation,” the company wrote, noting that the existing workflow cannot handle the surge without sacrificing quality.

Observers in the industry point out that this reflects a wider pattern: with large language models increasingly accessible, developers and hobbyists are employing them to automate vulnerability hunting. Though this can speed up detection, it also generates noise that may swamp genuinely critical problems.

Google did not disclose the duration of the pause, but indicated it will use the interval to improve its intake procedures, potentially adding automated filters or new verification stages to better handle AI‑generated content.

Security specialists warn that this scenario highlights the necessity for bounty programs to adapt as AI advances. “Programs must balance openness with the practical limits of human review,” said a cybersecurity analyst who requested anonymity. “Otherwise, the signal-to-noise ratio becomes untenable.”

The halt could lead other technology companies to reevaluate their reward schemes, particularly those heavily dependent on community contributions. As AI tools mature further, the sector is expected to make additional tweaks to maintain the effectiveness of vulnerability‑reporting ecosystems while harnessing the rapidity that automation offers.